Malicious Hubs: Detecting Abnormally Malicious Autonomous Systems

Conference · Thu Dec 31 23:00:00 EST 2009

OSTI ID:974218

Kalafut, Andrew J. ^[1]; Shue, Craig A ^[2]; Gupta, Prof. Minaxi ^[1]

---

1. Indiana University
2. ORNL

While many attacks are distributed across botnets, investigators and network operators have recently targeted malicious networks through high profile autonomous system (AS) de-peerings and network shut-downs. In this paper, we explore whether some ASes indeed are safe havens for malicious activity. We look for ISPs and ASes that exhibit disproportionately high malicious behavior using 12 popular blacklists. We find that some ASes have over 80% of their routable IP address space blacklisted and others account for large fractions of blacklisted IPs. Overall, we conclude that examining malicious activity at the AS granularity can unearth networks with lax security or those that harbor cybercrime.

• Research Organization: Oak Ridge National Laboratory (ORNL); Center for Computational Sciences
• Sponsoring Organization: USDOE
• DOE Contract Number: AC05-00OR22725
• OSTI ID: 974218
• Country of Publication: United States
• Language: English

Related Subjects

99 GENERAL AND MISCELLANEOUS
COMPUTER NETWORKS
CRIME DETECTION
Internet
SABOTAGE
SECURITY
cybercrime
malicious networks
network security